August 2015 - openSUSE Users - openSUSE Mailing Lists

[opensuse] openSUSE Distribution Security?
by Lew Wolfgang 24 Aug '15

24 Aug '15

Hi Folks, This is kind of a rhetorical question. Has there ever been a documented instance of malware being injected into either a base openSUSE release, or that was delivered by subsequent patch/application loads from repositories? How about the semi-official repositories? I remember the forums were compromised once upon a time. And are there any controls in place to prevent manipulation of repository mirrors? I know that the repositories have signatures, but what about the individual rpm files? Is there a master SHA-256 hash database that downloaded files could be checked against before being installed? I know, these may be dumb questions, but security seems to be on everyone's mind these daze. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

8 17

[opensuse] Chromium toolbar question
by Thomas Taylor 23 Aug '15

23 Aug '15

I've been using Firefox for many years now (oS 10.x) and am considering changing to Chromium. I've been able to get most of the settings the way I want but one thing I haven't been able to do is use custom toolbar buttons. In FF I open the file "custom-button-eccf45dc7.xpi" from codefisher.org and add buttons to the toolbar. So far, although I can open the file in Chromium, I haven't been able to figure out how to open the dialog box for adding the buttons to the toolbar. In FF this is done by right clicking on the toolbar but that isn't working in Chromium. 1: Are Chromium and Chrome the same thing? i.e.: is Chromium just the open source version of Chrome? 2: Is it even possible to easily modify the toolbar in Chrome and if so how? Thanks, Tom -- When you get all full of yourself try giving orders to a cat. - Anonymous ^^ --... ...-- / -.- --. --... -.-. ..-. -.-. ^^^^ Tom Taylor KG7CFC openSUSE 13.1 (64-bit), Kernel 3.11.6-4-default, KDE 4.11.2, AMD A8-7600, GeForce GTX 740 T/PCIe/ 16GB RAM -- 3x1.5TB sata2 -- 128GB-SSD FF 37.0, claws-mail 3.10.1 registered Linux user 263467 -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 0

Re: [opensuse] Possible SSH attacker?
by Marco Calistri 23 Aug '15

23 Aug '15

Il 21/08/2015 19:41, Greg Freemyer ha scritto: > > > On Fri, Aug 21, 2015 at 3:52 PM, Marco Calistri > <marco.calistri(a)yahoo.com.br <mailto:marco.calistri@yahoo.com.br>> wrote: > > Il 21/08/2015 12:44, Greg Freemyer ha scritto: > > On Fri, Aug 21, 2015 at 11:23 AM, Lew Wolfgang > <wolfgang(a)sweet-haven.com <mailto:wolfgang@sweet-haven.com>> wrote: > > On 08/21/2015 07:32 AM, Marco Calistri wrote: > > > Hello, > > I'm monitoring the /var/log/messages and I noticed this > kind of warning > (there are many similar): > > 2015-08-21T11:16:05.451779-03:00 linux-turion64 kernel: > [ 9894.977105 <tel:%5B%209894.977105>] > audit: type=2404 audit(1440166565.450:788): pid=4260 > uid=0 auid=4294967295 > ses=4294967295 msg='op=destroy kind=server > fp=ec:a9:63:90:61:bf:ea:53:d3:1b:fa:c3:38:da:ff:cc [MD5] > direction=? > spid=4260 suid=0 exe="/usr/sbin/sshd" hostname=? > addr=125.121.146.24 <tel:125.121.146.24> > terminal=? res=success' > > Have I to be worried? > > > I'm not familiar with that particular message, but the fact that > 125.121.146.24 <tel:125.121.146.24> is in China would make > me very nervous! It's > also blackholed by spamhaus. Do the other warnings > reference the same IP? > > Are you running sshd? Are you seeing any "sshd" entries > in /var/log/messages? > > Regards, > Lew > > > > I'm not aware of that specific message either, but failed ssh > connections from malicious IPs is so common it isn't worth > mentioning. > > I use fail2ban to scan my logs and look for failed SSH login > attempts. > On first detection it blocks that IP for some hours. Then after 3 > temporary blocks it does a permanent block. > > Currently I have 114 IPs in my permanent ban list. (I inadvertently > wiped it out a few months back.) > > I think most of the failed attempt try to login as root. I also > have > all root ssh access disabled. > > Greg > > > Greg, > > Interesting! > > This app., fail2ban is it difficult to setup? > > Thanks also to point out the important detail about ssh root access, > I will give a check to my ssh configuration. > > It is most probable my laptop is being attacked from a lot of days > or even months and I had not yet noticed it! > > Regards, > > -- > Marco Calistri > opensuse 13.2 (Harlequin) 64 bit - Kernel 4.1.5-2-desktop Gnome 3.16.2 > Intel® Core™ i5-2410M CPU @ 2.30GHz × 4 - Intel® Sandybridge Mobile > -- > To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org > <mailto:opensuse%2Bunsubscribe@opensuse.org> > To contact the owner, e-mail: opensuse+owner(a)opensuse.org > <mailto:opensuse%2Bowner@opensuse.org> > > > You should start a new thread, but it is not hard to use. Unfortunately > I don't think it can be setup via YaST. > > I have a newer fail2ban release installed from OBS (fail2ban-0.9.2). It > is easier to setup I think. The below may only apply to that version: > > It uses an override file /etc/fail2ban/jail.local. Here's mine: > > ========================> jail.local <================ > > # Fail2Ban jail base specification file > # > > # Comments: use '#' for comment lines and ';' (following a space) for > inline comments > > # The DEFAULT allows a global definition of the options. They can be > overridden > # in each jail afterwards. > > > [DEFAULT] > > > # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban > will not > # ban a host which matches an address in this list. Several addresses can be > # defined using space separator. > ignoreip = 127.0.0.1/8 <http://127.0.0.1/8> > > # > # ACTIONS > # > > # Some options used for actions > > # Destination email address used solely for the interpolations in > # jail.{conf,local,d/*} configuration files. > > destemail = "put your email address here" > > [sshd] > enabled = true > action = %(action_)s > > [sshd-ddos] > enabled = true > action = %(action_mw)s > > # Added by GAF (Greg Freemyer) from a v8.x recipe > [ssh-repeater] > enabled = true > filter = sshd > action = %(action_mw)s > logpath = %(sshd_log)s > maxretry = 21 > findtime = 31536000 > bantime = 31536000 > > =============================================================== > > I deleted my email address. Also I deleted my IPs from the "ignoreip" > line above. You should add any static IPs you use so your don't disable > your own access inadvertently. > > Note [ssh-repeater] is not part of the base install, so I also have to > have:an extra action file: > > ======== /etc/fail2ban/action.d/iptables-repeater.conf > # Fail2ban configuration file > # > # Author: Phil Hagen <phil(a)identityvector.com > <mailto:phil@identityvector.com>> > # > # This file is NOT part of openSUSE default. It was added by GAF (Greg > Freemyer) > # > > [Definition] > > # Option: actionstart > # Notes.: command executed once at the start of Fail2Ban. > # Values: CMD > # > actionstart = iptables -N fail2ban-REPEAT-ssh > iptables -A fail2ban-REPEAT-ssh -j RETURN > iptables -I INPUT -j fail2ban-REPEAT-ssh > # set up from the static file > cat /etc/fail2ban/ip.blocklist.ssh |grep -v ^\s*#|awk > '{print $1}' | while read IP; do iptables -I fail2ban-REPEAT-ssh 1 -s > $IP -j DROP; done > > # Option: actionstop > # Notes.: command executed once at the end of Fail2Ban > # Values: CMD > # > actionstop = iptables -D INPUT -j fail2ban-REPEAT-ssh > iptables -F fail2ban-REPEAT-ssh > iptables -X fail2ban-REPEAT-ssh > > # Option: actioncheck > # Notes.: command executed once before each actionban command > # Values: CMD > # > actioncheck = iptables -n -L INPUT | grep -q fail2ban-REPEAT-ssh > > # Option: actionban > # Notes.: command executed when banning an IP. Take care that the > # command is executed with Fail2Ban user rights. > # Tags: <ip> IP address > # <failures> number of failures > # <time> unix timestamp of the ban time > # Values: CMD > # > actionban = iptables -I fail2ban-REPEAT-ssh 1 -s <ip> -j DROP > # also put into the static file to re-populate after a restart > ! grep -Fq <ip> /etc/fail2ban/ip.blocklist.ssh && echo "<ip> > # fail2ban/$( date '+%%Y-%%m-%%d %%T' ): auto-add for repeat offender" >>> /etc/fail2ban/ip.blocklist.ssh > > # Option: actionunban > # Notes.: command executed when unbanning an IP. Take care that the > # command is executed with Fail2Ban user rights. > # Tags: <ip> IP address > # <failures> number of failures > # <time> unix timestamp of the ban time > # Values: CMD > # > actionunban = /bin/true > > [Init] > > # Defaut name of the chain > # > name = REPEAT > ============================================================================================ > > It seems to be working fine. > > Greg > > > > > Thanks for the details Greg, I will think about it despite I have not a 24/24 online system. Regards, -- Marco Calistri opensuse 13.2 (Harlequin) 64 bit - Kernel 4.1.5-2-desktop Gnome 3.16.2 Intel® Core™ i5-2410M CPU @ 2.30GHz × 4 - Intel® Sandybridge Mobile -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 4

[opensuse] cryptsetup open won't map LVM volumes
by Xen 23 Aug '15

23 Aug '15

Hey, I was just wanting to inform that in openSUSE, whenever you run "cryptsetup open /dev/... cryptname" the cryptdevice gets mapped (entry appears in /dev/mapper) but any LVM volumes are not loaded automatically. I also did not know how to do it by myself. LVM shows everything is allright in terms of "lvdisplay" displaying all the logical volumes, and the like. The "lvm" command itself didn't seem to have any option of getting the volumes to be loaded/mapped. The dmsetup command also did not have any way to actually load the LVM. Now that I have internet I might find out, but I did not have any, as I needed to use the openSUSE rescue mode to access my drive and reinstall grub. I could not. Fact was that I was in a bit of a pinch as I have no other computing resources available, my Windows installation suddenly wouldn't enable my wifi anymore (as a form of not doing "rfkill unblock all", supposedly) and if it were not for the Kubuntu Live disc I had burned just moments before, I would not be having any computer for the coming months unless I installed openSUSE again from scratch, possibly having to wipe the LUKS block device. Maybe that's all irrelevant, but I was completely stuck. Maybe the answer was to do vgchange -ay <volgroupname> I couldn't find it. This stuff is really well hidden. Maybe a thought? I don't know. I think these volumes would need to get mapped automatically. Regards, Bart. -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

4 4

[opensuse] systemd[1]: Reexecuting ? Drives (re)mounted on running system?
by MarkusGMX 23 Aug '15

23 Aug '15

I have seen ...systemd[1]: Reexecuting several times now in /var/log/messages. But only today I also realized that afterwards sometimes there is (thunderbird reformats output): ...systemd[1]: Activated swap /dev/disk/by-id/ata-M4-CT128M4SSD2_000000001137031962ED-part4. ... ...systemd[1]: Mounted /var ...systemd[1]: Mounted /boot. ...systemd[1]: Mounted /. ...systemd[1]: Found device M4-CT128M4SSD2. (that's where /boot is on) ...systemd[1]: Started File System Check on /dev/disk/by-id/ata-M4-CT128M4SSD2_000000001137031962ED-part3. ...systemd[1]: Found device M4-CT128M4SSD2. ...systemd[1]: Started File System Check on /dev/disk/by-id/ata-M4-CT128M4SSD2_000000001137031962ED-part2. ...systemd[1]: Found device M4-CT256M4SSD2. (2nd SSD =Windows boot) ...systemd[1]: Found device /dev/disk/by-id/md-uuid-49818217:13c92065:79a2503c:31fc331d-part1. ...systemd[1]: Found device M4-CT128M4SSD2. ...systemd[1]: message repeated 26 times: [ Found device M4-CT128M4SSD2.] ...systemd[1]: Found device M4-CT256M4SSD2. ...systemd[1]: message repeated 7 times: [ Found device M4-CT256M4SSD2.] ...systemd[1]: Found device /sys/devices/virtual/block/md126/md126p1. ...systemd[1]: Found device /dev/md126p1. (RAID1 !) I am using ext4 on a 13.1 SuSE. Are these fake messages or are the drives really remounted on a running system? Why? The message "repeated 26 times" also does worry me. Is the system going into some "bad state"? Problems with the controller? Thanks in advance ME -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

1 1

[opensuse] What reads a pdf that contains forms?
by David C. Rankin 23 Aug '15

23 Aug '15

All, There are new forms the courts require that I am having trouble reading. The following is a Civil Docketing Statement for the 4th Court of Appeals in Texas. The site recommends Adobe Reader, which I don't have. I've tried my old trusty kpdf (nope), the readers in FF39 (nope). What else will read it? http://www.txcourts.gov/media/515780/cv_ds.pdf -- David C. Rankin, J.D.,P.E. -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

15 66

[opensuse] Thunderbird : Incoming html e-mails, originating from MS source : dark matter
by ellanios82 23 Aug '15

23 Aug '15

Hello List , - as recently observed . . . 'yes' , confirmed : - Strange behavour of Linux Thunderbird : Incoming html e-mails originating from MS source , are not visible in Thunderbird folder-view : - just dark-matter ............. regards -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

8 16

[opensuse] kded5
by A. den Oudsten 22 Aug '15

22 Aug '15

I installed Tumbleweed snapshot 20150815 and directly uninstalled Kwalletmanager, while I don't want passwords organised by a program. Yet, when I let Tumbleweed awaken from hibernation, a program kded5 wants me to give password to Kwallet. The consequences from deleting kded5 are not clear for me, so I maintained it. Why am I forced to use Kwallet? Thanks in advance, André den Oudsten -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

2 1

[opensuse] Thunderbird 38.1.0 don’t show Outlook email if "HTML original" is selected
by Marco Calistri 22 Aug '15

22 Aug '15

Hello, Suddenly (may be after some of the latest Mozilla updates) Thunderbird started to have a problem when opening email sent from Outlook clients. The email body is not complete I.E. just the sender signature and signature's pictures are being displayed, the message text itself part is not. To be able to see the email body text I have to select View->HTML as simple. I believe Thunderbird applies a strict RFC rule and for this reason is discarding/hiding the text(?) I verify with different clients or even web email that Outlook email are displayed correctly then it is a specific Thunderbird issue. I'm attaching the excerpts of two HTML email sources in order to see the differences among them. The first is the Outlook source which is not fully displayed in Thunderbird with View->HTML as Original, while the second is another HTML source which went correctly displayed. # 1 HTML not fully displayed: Accept-Language: pt-BR, en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [HIDDEN] Content-Type: multipart/mixed; boundary="_009_ccd995d399dc4543b7cdf858ca9a44b6SNEPEXM02Phidden_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Return-Path: HIDDEN --_009_ccd995d399dc4543b7cdf858ca9a44b6SNEPEXM02Phidden_ Content-Type: multipart/related; boundary="_008_ccd995d399dc4543b7cdf858ca9a44b6SNEPEXM02Phidden_"; type="multipart/alternative" --_008_ccd995d399dc4543b7cdf858ca9a44b6SNEPEXM02Phidden_ Content-Type: multipart/alternative; boundary="_000_ccd995d399dc4543b7cdf858ca9a44b6SNEPEXM02Phidden_" --_000_ccd995d399dc4543b7cdf858ca9a44b6SNEPEXM02Phidden_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 # 2 HTML fully displayed Content-Type: multipart/related; boundary=001a1134de483afeb504fe42babe --001a1134de483afeb504fe42babe Content-Type: multipart/alternative; boundary=001a1134de483afeb304fe42babd --001a1134de483afeb304fe42babd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable If someone have faced the same issue and being able to resolve, please share with me the solution. Many thanks! Regards, -- Marco Calistri opensuse 13.2 (Harlequin) 64 bit - Kernel 4.1.3-4-desktop Gnome 3.14.2 Intel® Core™ i5-2410M CPU @ 2.30GHz × 4 - Intel® Sandybridge Mobile -- To unsubscribe, e-mail: opensuse+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse+owner(a)opensuse.org

7 38

[opensuse] Re: [open OFF LIST suse] political surreality thread [OT]
by Carlos E. R. 22 Aug '15

22 Aug '15

On 2015-08-22 05:06, Anton Aylward wrote: > On 08/21/2015 10:44 PM, Carlos E. R. wrote: >> >> Mmm... seems Spain is not the only stupid in the game :-P > > Its not really "Pot:kettle::Black", it too global, to pervasive and in > some places quite insidious. Oh, crumbs :-( This was supposed to go off-list, but you had reply-to set, and set to the list. So you mailed to me in private, but my reply went public and I did not notice. Sorry for the off topic on the list. -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)

1 0